Galaxy Research: Bitcoin losses related to the Coldcard bug have risen to $70 million

Comparing news, Galaxy Research said on Friday that more than 1,000 BTC from nearly 1,200 addresses, worth about $70 million, were transferred, and related transactions are thought to be related to a vulnerability affecting the Coldcard hardware wallet.

Earlier, Coldcard manufacturer Coinkite issued a warning on Thursday that the Coldcard Mk3 device generated mnemonics issues with ongoing issues. As a matter of caution, the company reminds all users using Mk3 that generate mnemonics with the firmware version 4.0.1 or later released in March 2021 that their funds may be at risk.

Coinkite then expanded the risk alert to include some Mk4, Mk5, and Coldcard Q firmware versions, and released emergency firmware updates for all affected models.

Coinkite CEO Rodolfo Novak (also known as NVK) apologized on Friday and said the company “takes full responsibility” for the firmware vulnerability, admitting that the internal review process failed to uncover the issue.

Novak also said the vulnerability may have been discovered using artificial intelligence, saying the incident reflects “the sobering reality of a new AI paradigm.” He warned that AI-assisted code reviews may uncover potential vulnerabilities faster than experienced security experts, and make it easier for attackers to take advantage of weaknesses in exposed code.